CVE-2024-7559 affects the File Manager Pro plugin for WordPress, where the mk_file_folder_manager AJAX action lacks proper validation of uploaded file types and does not enforce capability checks. This allows authenticated users with low privileges (Subscriber-level and above) to upload arbitrary files, potentially enabling remote code execution on the server hosting the WordPress site. The vulnerability is due to improper control of code generation (CWE-94). It impacts all versions up to and including 8.3.7. There is no vendor advisory or patch information available at this time.

An attacker with at least Subscriber-level access can upload arbitrary files to the server, which may lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. The high CVSS score (8.8) reflects the ease of exploitation and the severe impact on the affected site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and consider disabling or removing the File Manager Pro plugin if not essential. Monitor for updates from the vendor and apply patches promptly once released.